Tag: attack
-
Breach Roundup: Cisco SD-WAN Flaw Under Attack
OpenAI Agents Target Canada, ShinyHunters Suspect Arrested. This week: Cisco SD-WAN, OpenAI agents target Canada, ShinyHunters suspect arrested in Amsterdam, Japanese railway ransomware, AI labs investigated, an accused Chinese hacker misses his cellphone. Russian hackers, an ATM jackpotting network sanctioned and former airmen sentenced for BEC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-cisco-sd-wan-flaw-under-attack-a-33001
-
Operation KillSwitch: Police Dismantle KillSec Ransomware Group
Operation KillSwitch: Europol says the KillSec ransomware group, allegedly led by a 16-year-old, was dismantled after attacks on about 1,000 victims. Law enforcement seized control of KillSec ‘s dark web leak site, the Tor website the group used to threaten victims with publishing stolen files unless they paid up. That single action locked down more…
-
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years.That is the lesson…
-
16-year-old suspected leader of KillSec ransomware group arrested
A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/01/killsec-ransomware-16-year-old-main-operator-arrested/
-
AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/
-
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/warlock-ransomware-spanish-portuguese
-
Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks
Axios maintainers have disclosed several high-severity security vulnerabilities that could allow attackers to bypass proxy and DNS controls in server-side applications, potentially enabling server-side request forgery (SSRF) against internal services and cloud metadata endpoints. The most critical issue, tracked as GHSA-3pq3-5fj3-cg6v, affects Axios’s HTTP/2 request path. This vulnerability arises because the HTTP/2 adapter establishes sessions…
-
The Fine Art of Frustrating the Adversary
What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured urgency. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/the-fine-art-of-frustrating-the-adversary/
-
AI Threats Top Cybersecurity Preparedness Gap, PwC Finds
PwC finds global security leaders are most concerned about attacks on AI systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mitigating-adversarial-ai-top/
-
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption…
-
OpenAI reveals ‘novel’ encryption bypass used in distillation attack
The company said individuals associated with Chinese company MoonshotAI were behind parts of the attack, but did not offer hard evidence for the claim. First seen on cyberscoop.com Jump to article: cyberscoop.com/openai-moonshot-ai-model-distillation-attack/
-
‘The Art of War’ Never Said Know Only Your Vulnerabilities
Why Threat Intelligence Must Connect Adversary Intent to Business Risk Organizations have become adept at cataloging vulnerabilities, but technical exposure alone does not reveal who will attack – and why or how. Strategic threat intelligence connects adversary behavior with business context to guide security priorities. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/the-art-war-never-said-know-only-your-vulnerabilities-p-4201
-
‘The Art of War’ Never Said Know Only Your Vulnerabilities
Why Threat Intelligence Must Connect Adversary Intent to Business Risk Organizations have become adept at cataloging vulnerabilities, but technical exposure alone does not reveal who will attack – and why or how. Strategic threat intelligence connects adversary behavior with business context to guide security priorities. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/the-art-war-never-said-know-only-your-vulnerabilities-p-4201
-
‘The Art of War’ Never Said Know Only Your Vulnerabilities
Why Threat Intelligence Must Connect Adversary Intent to Business Risk Organizations have become adept at cataloging vulnerabilities, but technical exposure alone does not reveal who will attack – and why or how. Strategic threat intelligence connects adversary behavior with business context to guide security priorities. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/the-art-war-never-said-know-only-your-vulnerabilities-p-4201
-
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data,… First seen on hackread.com Jump to article: hackread.com/malfex-npm-windows-rat-steals-discord-browser-data/
-
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data,… First seen on hackread.com Jump to article: hackread.com/malfex-npm-windows-rat-steals-discord-browser-data/
-
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol…
-
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol…
-
Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/
-
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
‘Hit and run’ iPhone malware known as DarkSword is part of a wave of Russian attacks on iOS and Android devices, according to Ukraine’s SSSCIP. First seen on therecord.media Jump to article: therecord.media/ukraine-ssscip-mobile-malware-warning-ios-android
-
Microsoft to block Entra ID script injection attacks starting October
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-to-block-entra-id-script-injection-attacks-starting-october/
-
Know Your Enemy: Browser-Based Attack Techniques in 2026
Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser.Here are the six most dangerous techniques…
-
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters
The Russian state-backed hacking group Star Blizzard has expanded its phishing operations this year, using a new technique that makes it easier to infect victims with malware. First seen on therecord.media Jump to article: therecord.media/russia-hackers-ukraine-blizzard
-
Sweden boosts cyber threat security defences amid AI advances
Sweden is strengthening its national security defences against cyber attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651435/Sweden-boosts-cyber-threat-security-defences-amid-AI-advances
-
Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Software supply chain attacks are increasingly evolving into cloud identity breaches, as attackers weaponize trusted packages to steal credentials from developer workstations and CI/CD environments before an application is ever executed. The result is a dangerous pivot: a routine dependency installation can give threat actors access to cloud accounts, source-code repositories, container platforms, secrets-management systems,…
-
Apple Patches CoreGraphics Zero Day Exploited in Attacks
Apple has patched CVE-2026-86950, a zero-day bug in the iOS CoreGraphics engine First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/apple-patches-coregraphics-zero/